# US 2021/0344707 A1 · Detecting triggering events for distributed denial of service attacks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0344707 A1 - Document ID: US20210344707A1 - Status: Published application - Kind: A1 - Application number: 17/370,895 - Filed: 2021-07-08 - Published: 2021-11-04 - Earliest claimed: 2016-04-22 - Assignees: Sophos Limited - Applicants: Sophos Limited - Inventors: Karl Ackerman; Mark David Harris; Simon Neil Reed; Andrew J. Thomas; Kenneth D. Ray - Web page: https://patentgrep.com/patent/US20210344707A1 ## CPC - H04L 63/1458: {Denial of Service} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An endpoint in an enterprise network is monitored, and when a potential trigger for a distributed denial of service (DDoS) attack is followed by an increase in network traffic from the endpoint to a high reputation network address, the endpoint is treated as a DDoS service bot and isolated from the network until remediation can be performed. ## Claims ### Claim 1 A computer program product for protecting against distributed denial of service attacks from an enterprise network, the computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of: detecting a potential trigger event on an endpoint in the enterprise network for a distributed denial of service attack; in response to detecting the potential trigger event, monitoring outbound traffic from the endpoint for an increase in network traffic from the endpoint directed to a high reputation network address over a predetermined time; in response to the potential trigger event followed by the increase in network traffic over the predetermined time, identifying the endpoint as having a compromised state in which the endpoint serves as a distributed denial of service bot for the distributed denial of service attack; and preventing all network traffic from the endpoint to the high reputation network address until the compromised state is remediated. ### Claim 2 (depends on 1) The computer program product of claim 1, wherein the potential trigger event is a detection of a process on the endpoint that monitors a clock. ### Claim 3 (depends on 1) The computer program product of claim 1, wherein the potential trigger event is a detection of a process on the endpoint that monitors a file on the endpoint. ### Claim 4 (depends on 1) The computer program product of claim 1, wherein the potential trigger event is a detection of network traffic between the endpoint and a low reputation network address. ### Claim 5 (depends on 1) The computer program product of claim 1, wherein the potential trigger event is a detection of network traffic from a command and control site. ### Claim 6 (depends on 1) The computer program product of claim 1, wherein the potential trigger event is a detection of an increase in network traffic to the high reputation network address from one or more other endpoints in the enterprise network. ### Claim 7 (depends on 1) The computer program product of claim 1, wherein monitoring the outbound traffic includes monitoring the outbound traffic at a gateway for the enterprise network. ### Claim 8 (depends on 1) The computer program product of claim 1, wherein monitoring the outbound traffic includes monitoring the outbound traffic at the endpoint. ### Claim 9 A method, comprising: monitoring outbound traffic from an endpoint in an enterprise network; detecting a potential trigger event for a distributed denial of service attack; in response to detecting the potential trigger event, monitoring the outbound traffic from the endpoint for an increase in network traffic from the endpoint directed to a high reputation network address over a predetermined time; in response to the potential trigger event followed by the increase in network traffic over the predetermined time, identifying the endpoint as having a compromised state wherein the endpoint serves as a distributed denial of service bot; and preventing all network traffic from the endpoint to the high reputation network address until the compromised state is remediated. ### Claim 10 (depends on 9) The method of claim 9, wherein the potential trigger event is a detection of a process on the endpoint that monitors a clock. ### Claim 11 (depends on 9) The method of claim 9, wherein the potential trigger event is a detection of a process on the endpoint that monitors a file on the endpoint. ### Claim 12 (depends on 9) The method of claim 9, wherein the potential trigger event is a receipt of a message on the endpoint from a low reputation network address. ### Claim 13 (depends on 9) The method of claim 9, wherein the potential trigger event is a receipt of a message on the endpoint from a command and control site. ### Claim 14 (depends on 9) The method of claim 9, wherein the potential trigger event is a detection of an increase in network traffic to the high reputation network address from one or more other endpoints in the enterprise network. ### Claim 15 (depends on 9) The method of claim 9, wherein monitoring the outbound traffic includes monitoring the outbound traffic at a gateway for the enterprise network. ### Claim 16 (depends on 9) The method of claim 9, wherein monitoring the outbound traffic includes monitoring the outbound traffic at the endpoint. ### Claim 17 (depends on 9) The method of claim 9, wherein monitoring for an increase in network traffic includes monitoring for an increase in network traffic beyond a predetermined threshold. ### Claim 18 (depends on 9) The method of claim 9, further comprising remediating the endpoint. ### Claim 19 A threat management facility for managing an enterprise network, the threat management facility comprising: a network interface for coupling the threat management facility to the enterprise network; a memory; and a processor, the processor configured by computer executable code stored in the memory to protect against a distributed denial of service attack occurring within the enterprise network by performing the steps of monitoring outbound traffic from an endpoint in the enterprise network, detecting a potential trigger event on the enterprise network for a distributed denial of service attack, in response to detecting the potential trigger event, monitoring the outbound traffic from the endpoint for an increase in network traffic from the endpoint directed to a high reputation network address over a predetermined time, in response to the potential trigger event followed by the increase in network traffic over the predetermined time, identifying the endpoint as having a compromised state wherein the endpoint serves as a distributed denial of service bot, and preventing network traffic from the endpoint until the compromised state is remediated. ### Claim 20 (depends on 19) The threat management facility of claim 19, wherein the processor is further configured to initiate a remediation of the endpoint.